Home / server / Questions / 896283
In Process
oligofren
Asked: 2018-02-09 02:33:41 +0800 CST

Why is kjournald showing up 700 times in `netstat`?

  • 772

AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, connecting to an IP belonging to some company in Italy (bladerunner.consultingweb.it).

$ sudo netstat -tapn | grep 195.128.235.204
tcp        0      0 192.168.10.2:40298      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57720      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51432      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:41414      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40978      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:35624      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39832      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:54744      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58092      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51320      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34280      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53338      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51016      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58592      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34622      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57781      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:32810      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60852      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38062      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60430      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57078      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:41574      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51022      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40004      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58926      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58840      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44256      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:37728      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56234      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:59458      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:32922      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:49780      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38502      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:50161      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57556      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:54720      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57006      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:48682      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:46554      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58090      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38030      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38719      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56058      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38986      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44568      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39028      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56554      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56598      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45916      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53928      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34792      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:59738      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:35520      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:59982      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53700      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55614      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56916      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57932      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53244      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:47948      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57394      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44556      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60434      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55224      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56480      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34782      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:48428      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36124      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:37102      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:33032      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:52590      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45902      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44980      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60040      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:35432      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:48280      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:46228      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:46508      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45244      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:54024      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55690      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58760      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58204      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36384      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:35826      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:41240      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:35724      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56584      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40854      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:43338      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51895      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40430      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:41086      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53172      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36066      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56060      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55002      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55236      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:49310      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:47750      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36626      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34086      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55952      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39652      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:54506      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:48116      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:46141      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:54170      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39910      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38612      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36442      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:46938      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51056      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:32866      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:49762      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:42960      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:43648      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60578      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45604      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57336      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60136      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:50864      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53514      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:33970      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:49662      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39208      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:49070      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39336      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60948      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51636      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45510      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44562      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44269      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36108      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53422      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53904      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:50160      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:47702      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58108      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:52148      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57710      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51468      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:52660      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40262      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38000      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:38718      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:43164      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51926      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57748      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:49084      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36500      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:42730      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:42422      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58998      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:33216      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58696      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:52436      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:47180      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:50716      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53922      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:33278      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:43736      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:51336      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:42176      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57557      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:42606      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39050      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58302      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:48976      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:47338      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:33666      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56760      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:42672      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39714      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40634      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34132      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:58454      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36868      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:35094      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56484      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60266      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:33218      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:52490      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:34398      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:36502      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:46528      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:53344      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:55416      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56762      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:56990      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45376      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:40574      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:45362      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:57274      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:39122      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:44852      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
tcp        0      0 192.168.10.2:60802      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]
...
etc


kaufman at timbuktu in ~ 
$ sudo netstat -tapn | grep 195.128.235.204 | wc -l
664

I really don't get this. The kjournald doesn't seem like some tampered executable, but some kind of internal tool, so I am not sure how to go about this:

$ cat /proc/20086/cmdline 
[kjournald]

I tried nmaping and telneting the port, but couldn't understand what it was doing: 

$ telnet 195.128.235.204 2525
Trying 195.128.235.204...
Connected to 195.128.235.204.
Escape character is '^]'.
NOTICE AUTH :*** Looking up your hostname...

Attempt two

$ sudo nmap -p 2525 195.128.235.204

Starting Nmap 7.01 ( https://nmap.org ) at 2018-02-08 11:36 CET
Nmap scan report for bladerunner.consultingweb.it (195.128.235.204)
Host is up (0.042s latency).
PORT     STATE SERVICE
2525/tcp open  ms-v-worlds

Nmap done: 1 IP address (1 host up) scanned in 0.72 seconds
hacking

1 Answers

  1. As suspected, this was the result of hacking. A full postmortem can be found on GitHub, along with all the scripts and how I found out.

    Basically:

    # finding the process number
sudo netstap -tapn | grep kjournald
...
tcp        0      0 192.168.10.2:37126      195.128.235.204:2525    ESTABLISHED 20086/[kjournald]

# finding which executable is running under that process
sudo ls -lh /proc/20086/exe                                                                                                                                                                                                                                                             
lrwxrwxrwx 1 root root 0 feb.   8 15:56 /proc/20086/exe -> /var/tmp/32a1e380

# ehhh ... that seems weird
# goodbye
$ sudo rm /var/tmp/32a1e380*
$ sudo kill 20086
    • 0